Description:

CVE-2024-0610 is a time-based blind SQL injection vulnerability in the Piraeus Bank WooCommerce Payment Gateway plugin for WordPress. This vulnerability allows unauthenticated attackers to extract sensitive information from the database by appending additional SQL queries into existing queries.

Key Insights:

• High Severity: The CVSS score of 9.8 indicates that this vulnerability is highly severe and requires immediate attention.
• Active Exploitation: Active exploits have been published, indicating that this vulnerability is being actively exploited by hackers.
• CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.
• SVRS Score: The SOCRadar Vulnerability Risk Score (SVRS) for this vulnerability is 0, indicating that it is not a critical vulnerability and does not require immediate action.

Mitigation Strategies:

• Update the Piraeus Bank WooCommerce Payment Gateway plugin to version 1.6.5.2 or later.
• Implement input validation and sanitization to prevent SQL injection attacks.
• Use a web application firewall (WAF) to block malicious requests.
• Regularly monitor logs for suspicious activity and take appropriate action.

Additional Information:

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.